MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61f2809ca8a8b12559524a25242d34ad3fbf2bbaae3a8886fbfd8ed311ea8eb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61f2809ca8a8b12559524a25242d34ad3fbf2bbaae3a8886fbfd8ed311ea8eb5
SHA3-384 hash: dbf626a5a8e23d623c902a128e702cf94290fe43f87053d1795449dd9415363d0a0882825e91b9e9fcf68985764b1065
SHA1 hash: fdc79c37f4e7b27cb99f1df11d6c22a0a7b59f1a
MD5 hash: dedbd05cb444938b6bfaec479f5e633f
humanhash: bulldog-white-minnesota-nine
File name:Mediform SA Order 18082020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:480'726 bytes
First seen:2020-08-18 13:19:02 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Du1CVfOfcjl9J87GOILVfIk9pOLIqqhoJukYwcKah7DYKmUmUx5puA2izouLrBO2:DSCS0/hnGIttxNDYymK/uok2
TLSH B0A4235F54317C687B6BBC98CC7E2E3A125BA64B4013115BAFA4534824AD36CF0D78E3
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tacadenaplc.pw
Sending IP: 104.168.253.8
From: Mediform S.A<mediform.s.a@hotmail.com>
Subject: Re:Fw: Request For New Inquiry RFQ
Attachment: Mediform SA Order 18082020.rar (contains "Mediform SA Order 18082020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61f2809ca8a8b12559524a25242d34ad3fbf2bbaae3a8886fbfd8ed311ea8eb5/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 05:39:50 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mhzibhfivcyskwksjissiljuvu736k52vy5irbx37whngepkr22q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/61f2809ca8a8b12559524a25242d34ad3fbf2bbaae3a8886fbfd8ed311ea8eb5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 61f2809ca8a8b12559524a25242d34ad3fbf2bbaae3a8886fbfd8ed311ea8eb5

(this sample)

AgentTesla

Executable exe 7867241670b0fd664072e1bf555bc56b8291a80e01adeebcffcc768a0e88c117

  
Dropping
MD5 3e4351154826c9bdf1fae3d9308247a2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7867241670b0fd664072e1bf555bc56b8291a80e01adeebcffcc768a0e88c117

Comments